Fortinet’s FortiGuard Labs has detailed a cyberespionage campaign targeting South Asian organizations in government, energy, and engineering sectors. The researchers attribute the activity with high confidence to BITTER APT, a suspected South Asian group active since at least 2013.
Infection Chains Explained
FortiGuard Labs identified three chains BITTER uses to deliver a custom remote access trojan (RAT) called PapRAT to Windows systems, and noted that the attackers didn’t rely on exploiting any software vulnerability but focused on deception mostly.
In one chain, attackers used diplomatic- and military-themed LNK shortcuts to launch a script disguised as an icon file through ftp.exe, and relied on living-off-the-land (LotL) techniques. Using built-in Windows utilities such as ftp.exe and curl, along with PowerShell and scheduled tasks, attackers ran commands without initially dropping a conventional malware executable.
The script gathered system and antivirus information and sent the data to a command-and-control (C2) server in a file named abc.pdf. A fake Windows error message helps distract the victim.
The second chain uses a VHDX disk image titled “Letter from the Ambassador – 11th Belt and Road Summit.vhdx.” When mounted, it exposes a shortcut that opens a decoy spreadsheet while launching an MSI installer, Visa_Details.msi, in the background. The installer deploys PapRAT disguised as Microsoft software.
The third chain starts with a RAR archive containing a URL shortcut that retrieves an LNK file through WebDAV. That shortcut eventually launches another MSI installer, Imp_Details.msi, which deploys PapRAT.
PapRAT’s Capabilities
FortiGuard Labs identified PapRAT through build artifacts, including the product name “papsolutions” and the PDB filename “requpap.pdb.” The RAT supports remote command execution, file uploads and downloads, file deletion, directory and drive listing, and screenshot capture.
In the third chain, PapRAT downloads a second implant, WmRAT, disguised as vnces.exe. WmRAT connects to netmansrvdns.com for further commands.
The researchers found C++ and Rust versions of PapRAT. The C++ sample’s C2 configuration is XOR-encoded with key 0x50. The Rust version reverses and ROT-3-shifts strings stored in its .rdata section to conceal its C2 address. It also expands PapRAT’s command set from eight to eleven, adding PowerShell execution, a sleep command, and a clean exit. The Rust variant waits 42 seconds before starting and then checks in every five seconds.
Hackread.com has previously reported on BITTER’s use of malicious archives and custom backdoors in attacks targeting government and military organizations. In April, we also covered the group’s use of ProSpy spyware in a campaign targeting journalists and opposition figures in the Middle East.
The new findings add another part to BITTER’s activity. As researchers noted in the blog post, the campaign shows how BITTER “combines native Windows tools with custom malware to establish and maintain access to targeted systems.” Security teams monitoring targeted sectors must inspect scheduled tasks, scripting tools, and installer activity alongside traditional antivirus signatures to detect these living-off-the-land techniques.
Expert Commentary:
Shane Barney, Chief Information Security Officer at Keeper Security, shared his comments with Hackread.com, stating, “This campaign illustrates how advanced cyberespionage operations deliberately abuse native system tools to evade traditional endpoint detection. By co-opting native Windows utilities like ftp.exe and scheduled tasks to establish initial command-and-control communication, threat actors operate within trusted administrative channels before deploying custom malware.”
“Defending against this hybrid tradecraft requires security teams to focus on strict privilege boundaries and identity security, rather than endpoint signatures alone. Organizations must enforce least-privilege access across all user endpoints, restrict access to native scripting engines, and eliminate standing administrative rights that allow these scripts to execute maliciously,” he added.
